plugins/github-copilot-modernization/skills/implementing-code/SKILL.md
Executes a batch of implementation tasks with TDD workflow, source-anchored rewrite for behavioral fidelity, guideline-based code transformation, and full requirement tracing. Returns a structured batch report. Triggers: "implement tasks", "execute the batch", "write code for these tasks", "implement with source anchoring", "run the implementation". NOT for: task generation (use breaking-down-tasks), implementation planning (use creating-implementation-plan).
npx skillsauth add microsoft/github-copilot-modernization implementing-codeInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
You MUST consider the user input before proceeding (if not empty).
Code files are written into the project tree. The batch report is written under the provided artifact path.
batch-report.yaml ← structured result consumed by caller
Confirm required artifacts exist: plan.md (with task list and Requirement Mapping table), feature spec.
Read from the provided artifact path and dependency artifacts. Scan the artifact directory to find these categories:
| Category | Required | Purpose | Look for |
|----------|----------|---------|----------|
| Task breakdown | ✅ | Work items with T-IDs to implement | Artifact with task IDs (T001, T002...), may be in tasks/ subdirectory or main planning artifact |
| Feature spec | ✅ | Requirements (REQ-XXX) and acceptance criteria | Artifact with REQ-XXX identifiers and user scenarios |
| Constitution | ✅ | Project principles and constraints | Usually named constitution.md in artifact root |
| Implementation plan | ✅ | Phased plan with architecture decisions | Artifact with phased sections and plan references |
| Architecture design | ✅ | API contracts, layering, package structure | Artifact with design decisions |
| Data model | If exists | Entity definitions, mappings, FK strategy | Artifact with schema/entity details |
| UX/UI spec | If exists | Screen layouts, user flows, components | Artifact with screen specs |
| Knowledge graph | If exists | Module dependencies and class relationships | JSON file with nodes/edges in artifact path |
| Checkpoints | If exists | Upstream traceability | YAML files in checkpoints/ subdirectory |
| Guidelines | If exists | Migration rules and transformation patterns | Search guidelines skill |
If checklists/ directory exists, scan checklist files. If any incomplete items: display table and ask before proceeding.
Create/verify ignore files. See references/ignore-patterns.md for patterns by language/tool.
From the task breakdown artifact, find tasks that match your current assignment:
Unmet dependency not in current batch → report as blocked.
Before writing any implementation code, check whether an endpoint contract test script exists in the project root:
for script in api-test.sh api-check.sh smoke.sh health-check.sh test-api.sh; do
test -f "./$script" && echo "found: $script" && break
done
If a script is found:
T_API_dashboard: Implement GET /api/dashboard).batch-report.yaml under required_endpoints:
required_endpoints:
- method: GET
path: /api/dashboard
source: api-test.sh
status: pending # updated to "implemented" when the endpoint is wired up and verified
- method: GET
path: /api/items
source: api-test.sh
status: pending
If no script is found:
clarification.md (if present) for any explicitly listed required API endpoints.This discovery step ensures that evaluation scripts are treated as first-class requirements from the start of implementation — not discovered only at post-build verification when fixes are costly.
Ordering:
[P] tasks: can run togetherTDD Flow:
mvn test -pl <module> -am). ALL tests must PASS. Report pass/fail/skip counts in batch report. Test failure = task NOT complete.Constitution & Requirement Fidelity:
REQ-XXX — implement requirement intent, not just task description.Source-Anchored Rewrite (MANDATORY in rewrite mode):
For tasks with [Source:], follow references/source-anchored-rewrite.md.
Guideline-Based Transformation:
For tasks marked [GUIDELINE:skill-name]:
skills/guidelines/Parallelism: Run independent tasks ([P] marked) in parallel as much as possible to maximize throughput.
Error Handling:
[P] tasks: continue successful ones, report failuresAfter any scaffolding step that generates or modifies a package.json, execute this gate before proceeding to the next task. This gate is MANDATORY for all JavaScript and TypeScript projects.
Check that package.json contains BOTH a build script AND a test script:
node -e "
const pkg = require('./package.json');
const missing = ['build','test'].filter(s => !pkg.scripts || !pkg.scripts[s]);
if (missing.length) { console.error('MISSING scripts:', missing.join(', ')); process.exit(1); }
console.log('scripts OK: build=' + pkg.scripts.build + ', test=' + pkg.scripts.test);
"
If either script is missing, inject it immediately — do NOT defer:
| Framework | Missing test script | Missing build script |
|-----------|----------------------|----------------------|
| Angular (@angular/core in deps) | "test": "ng test --watch=false --browsers=ChromeHeadless" | "build": "ng build" |
| React / Vite | "test": "vitest run" or "test": "react-scripts test --watchAll=false" | "build": "vite build" |
| React / CRA | "test": "react-scripts test --watchAll=false --ci" | "build": "react-scripts build" |
| Vue / Vite | "test": "vitest run" | "build": "vite build" |
| Next.js | "test": "jest --ci" | "build": "next build" |
| NestJS / Node | "test": "jest --ci" | "build": "nest build" |
| Generic TS | "test": "jest --ci" | "build": "tsc" |
After injecting, confirm the script was written and re-verify with the check above.
After confirming both scripts exist, execute:
npm test
(or yarn test / pnpm test if the project uses those package managers)
npm testbatch-report.yaml under warnings with severity HIGH and continue — do NOT block the entire batch:
warnings:
- severity: HIGH
message: "npm test failed after 3 remediation attempts — <last error summary>"
Why this gate exists: Eval harnesses run
npm testunconditionally. A scaffolded project without atestscript causes an immediate fatal error (npm error Missing script: "test") that masks all other results. Catching this at scaffolding time costs ~5 seconds; missing it causes total batch failure.
For any batch that produces or modifies a web-application backend (Spring Boot, Express, NestJS, FastAPI, Django, ASP.NET Core, Go HTTP servers, and similar), verify endpoints respond correctly at runtime before the batch is considered complete. A passing build proves only compilation, not that routes are wired up.
If Step 5.5 found an endpoint contract script (api-test.sh, api-check.sh, …), start the application if not already running, then execute it:
bash ./api-test.sh # or whichever script Step 5.5 recorded
echo "api-test exit code: $?"
batch-report.yaml under warnings with severity HIGH and escalate via [notify:coordinator] — do NOT mark the affected endpoints implemented.If no endpoint contract script exists, probe every REST endpoint the batch implemented after starting the application:
curl -sf -o /dev/null -w "%{http_code}" http://localhost:<PORT><endpoint>
Every implemented endpoint MUST return a 2xx status code. A 404 or 500 means the route is not wired correctly — fix before completing the batch. Record probe results in the batch report under endpoint_probes:
endpoint_probes:
- method: GET
path: /api/dashboard
status: 200
result: PASS
After ALL tasks in this batch complete, write checkpoints/tasks-to-impl.yaml using templates/tasks-to-impl-checkpoint-template.yaml. This is REQUIRED — completeness gate reads it to verify traceability.
Generate batch result report per references/batch-report-format.md (YAML format).
If required_endpoints was populated in Step 5.5, update each entry's status to "implemented" once the corresponding endpoint is wired up and verified to respond correctly. Any entry still "pending" at report time is a gap — record it under warnings with severity HIGH:
warnings:
- severity: HIGH
message: "Endpoint GET /api/dashboard was required by api-test.sh but not implemented in this batch"
references/source-anchored-rewrite.md — Rewrite-mode behavioral fidelity processreferences/ignore-patterns.md — Ignore file patterns by language/toolreferences/batch-report-format.md — Required YAML output formatdevelopment
Scan dependency manifests against known CVEs and remediate by upgrading vulnerable dependencies to patched versions, then rebuild and re-scan to confirm. Self-contained scan→fix→verify loop for any project with a dependency manifest. Use when: a cve-remediation task is dispatched; dependency set changed (version bump, new framework); assessment flagged vulnerable or EOL dependencies; or user asked to "fix CVEs", "patch vulnerabilities", or "dependency security". Triggers: "cve", "remediate cve", "fix cves", "patch vulnerable dependencies", "vulnerability scanning", "dependency security", "vulnerable dependencies", "security advisories", "npm audit", "pnpm audit", "maven audit", "gradle audit", "dependency scan", "vulnerability remediation". NOT for: security audit of auth/input/secrets/OWASP code paths (use security-review).
development
Generate dependency map diagram from project build files
documentation
Generate data architecture and persistence layer documentation with data model diagram
documentation
Generate core business workflow documentation with sequence diagram